CVE-2024-46987

CVSS V2 None CVSS V3 None
Description
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Overview
  • CVE ID
  • CVE-2024-46987
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-09-18T17:15:45.829Z
  • Last Modified Date
  • 2024-09-18T18:59:41.388Z
Weakness Enumerations
CWE URL
CWE-200 http://cwe.mitre.org/data/definitions/200.html
CWE-22 http://cwe.mitre.org/data/definitions/22.html
References
Reference URL Reference Tags
https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c x_refsource_CONFIRM
https://codeql.github.com/codeql-query-help/ruby/rb-path-injection x_refsource_MISC
https://owasp.org/www-community/attacks/Path_Traversal x_refsource_MISC
https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-46987
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46987
History
Created Old Value New Value Data Type Notes
2024-10-06 04:04:00 Added to TrackCVE